The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
3answers
39 views

How do you get an SNI certificate for internal host-names?

I have a Synology NAS at home, which has a web-based user-interface which I expose to the public Internet. Inside my LAN my NAS has the hostname nas.domain.local. and on the public Internet I have the ...
0
votes
0answers
15 views

How should a wildcard certificate be used? [migrated]

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the ...
1
vote
1answer
215 views

logstash-forwarder failed to tls handshake cannot validate cert because it doesnt contain any IP SANS

I have a logstash / elastic search / kibana server on ubuntu 14.x 64bit. I have a few other servers with the same spec using logstash-forwarder, and everything is working as expected. However, when ...
0
votes
1answer
28 views

How to sign a CSR on windows

I've got a custom certificate that I'm using as a local root authority. This certifcate has a private key on my machine and is stored in the "Personal" certificates store of the "Local Machine" ...
1
vote
2answers
528 views

s_client not failing on revoked certifcate?

I'm running Firefox with with the EFF's HTTPS Everywhere. I recently visited Lavabit's site to see if its accepting donations: The revocation is expected considering the history.... However, I'm ...
1
vote
1answer
1k views

Can't S/MIME sign using OpenSSL even if “verify” suceeds

I have a client certificate in Chrome, that I used for logging into StartSSL. I exported it using pk12util to certfile.p12. Now I want to use it for signing with S/MIME. I converted the p12 file to ...
0
votes
0answers
2k views

Firefox, “Secure Connection Failed” and client certificate

I have a client certificate for Satrtcom. I'm trying to authenticate to their service, but I'm receiving a "Secure Connection Failed" error with error code ssl_error_handshake_failure_alert: The ...
2
votes
1answer
671 views

Incorrect Authority Key Identifier on openssl end cert

I'm getting interesting results when signing an end-server certificate using an intermediate CA using openssl. I have a Root CA which looks like this: Serial Number: 14296918985177649921 ...
2
votes
0answers
74 views

SSL cert owner != localhost after creating SSH tunnel

I use an SSH tunnel to connect to my work's mail server, then tell my mail client to connect to server "localhost" on port "1993" (the port I chose for the tunnel). I have two different Ubuntu Precise ...
2
votes
1answer
242 views

What's a good database-backed X.509 certificate authority on Linux

I've been using OpenSSL as an X.509 certificate authority. Because multiple machines will need to create certificates, I've exported the certificate authority folder on a distributed filesystem. When ...
2
votes
1answer
490 views

Alternatives to SSH x509 logon

I have a Windows 7 machine which is not part of domain, and a Linux machine. I want to login to Linux from Windows using an x509 certificate stored in windows certificate store. Is it possible? ...
3
votes
2answers
2k views

OpenSSL: How to create a certificate with an empty subject DN?

Is it possible to create a PKCS#10 certificate request / X.509 certificate with the identifying information only in the subject alternate name attribute/extension? According to X.509 4.1.2.6 Subject, ...
0
votes
1answer
2k views

How to make an x.509 certificate from a PEM one?

I'm trying to test a script, locally, which involves uploading a file using a Java-based program to a FileZilla FTPES server. For the real thing, there is a real certificate on the FZ server, and the ...
2
votes
2answers
258 views

Primary 'common name' in subjectAltName?

I have my own X.509 CA. When issuing certificates for hosts, if I have Subject: .../CN=foobox.grawity.tld and subjectAltName: DNS:foobox.local, do I still have to put DNS:foobox.grawity.tld as a ...
4
votes
4answers
1k views

X.509 certificates - expiration and key reuse

I have set up a small X.509 certificate authority for internal use in my network. Now I want to renew a certificate, and I want to know how should I do it. Can the new certificate reuse the same key ...